Bitcoin Forum

Bitcoin => Bitcoin Technical Support => Topic started by: ewaspiro on December 26, 2019, 04:57:14 PM



Title: unknown wallet.dat format
Post by: ewaspiro on December 26, 2019, 04:57:14 PM
I have found an old wallet.dat wallet which after scanning show only unconfirmed transactions with unknown addresses.

Same wallet scans in litecoin core wallet with unconfirmed transactions.

Is there any other tool than pywallet that could output whats inside the wallet and parse it?

Is there a page with all bitcoin forks that supports wallet.dat format?

thanks in advance
EWA


Title: Re: unknown wallet.dat format
Post by: Red-Apple on December 26, 2019, 06:24:42 PM
I have found an old wallet.dat wallet

where did you "find" this file?


Title: Re: unknown wallet.dat format
Post by: ewaspiro on December 26, 2019, 07:23:02 PM
I have found an old wallet.dat wallet

where did you "find" this file?

The transactions are from 2014 and I dont recall which coin it is.

What are you trying to say? If there is nothing you can add to the topic then dont bother fill with insults.


Title: Re: unknown wallet.dat format
Post by: Btcspot on December 26, 2019, 07:33:32 PM
 How much is in the wallet? Are you using bitcoin core.


Title: Re: unknown wallet.dat format
Post by: HCP on December 26, 2019, 08:09:03 PM
If the file isn't encrypted... (ie. no wallet password), then there was a method that you could use to scan the wallet.dat file for "names" (it would be the actual addresses in string format, as opposed to public key/hex etc) and you could use the address prefix to work out what sort of coin you were dealing with. ie. 1 = Bitcoin, L = Litecoin, D = Dogecoin etc.

This stackexchange link has a couple of options to do it using either pywallet or the gist script mentioned in one of the answers: https://bitcoin.stackexchange.com/questions/19589/how-to-determine-what-type-of-coins-a-wallet-dat-contains

If the wallet is encrypted, it might be a bit more difficult... although pywallet might still work.




Title: Re: unknown wallet.dat format
Post by: Red-Apple on December 27, 2019, 05:38:28 AM
I have found an old wallet.dat wallet

where did you "find" this file?

The transactions are from 2014 and I dont recall which coin it is.

What are you trying to say? If there is nothing you can add to the topic then dont bother fill with insults.

where did you get "insult" from? :o
you seem to be so sensitive! knowing where you have gotten this wallet.dat file could help a lot. for example if it was among your backup files or if it was converted by you (maybe changed the name or extension), or if it was recovered using a recovery tool from a hard disk that failed or if you bought it from the someone on the internet saying it has free coins inside.

depending on "where" you have gotten the file, the steps you could take to recover the funds are entirely different.


Title: Re: unknown wallet.dat format
Post by: nc50lc on December 27, 2019, 06:25:40 AM
I have found an old wallet.dat wallet which after scanning show only unconfirmed transactions with unknown addresses.
Can you view the TXID of those unconfirmed transactions?
If so, copy and paste them to a multi-coin blockexplorer and see if you can get a result, try: https://multihash.net/en (https://multihash.net/en)


Title: Re: unknown wallet.dat format
Post by: ewaspiro on December 27, 2019, 06:43:49 PM
This stackexchange link has a couple of options to do it using either pywallet or the gist script mentioned in one of the answers: https://bitcoin.stackexchange.com/questions/19589/how-to-determine-what-type-of-coins-a-wallet-dat-contains

Or open wallet.dat directly with text editor and find keyword name

Public key starts with W

the dumpwallet.py from the stackexchange link cannot read the file and pywallet thinks its Bitcoin by default


Title: Re: unknown wallet.dat format
Post by: ewaspiro on December 27, 2019, 07:37:11 PM
Or open wallet.dat directly with text editor and find keyword name

Public key starts with W

I thought you still identify which coins inside your wallet.dat ?

yes, I dont know what coin is W i just followed your suggestion and checked the wallet.dat manually looking for name tag


Title: Re: unknown wallet.dat format
Post by: HCP on December 27, 2019, 08:10:15 PM
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Website: https://wagerr.com/
Github (for "Core" Wallet): https://github.com/wagerr/wagerr/releases

They also have a blockexplorer here: https://explorer.wagerr.com/#/
So you can try putting some of your addresses and/or transaction IDs (if you can see them) into the explorer and see if it matches.

NOTE: I have never heard of, or used, Wagerr... but it seems like it is still in active development/use: https://bitcointalk.org/index.php?topic=5186141


EDIT: wait... Public Key starts with "W" or those "name" records in the wallet.dat start with "W"? ???


Title: Re: unknown wallet.dat format
Post by: BitMaxz on December 28, 2019, 11:17:27 PM
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Just adding this below.

MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"

Their explorer here: https://mic3.magicdevs.pro/address/MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY

Bitcurrency also have "W" addresses before the first address before they switch to "B" address.

Check this post https://bitcointalk.org/index.php?topic=867474.msg10286233#msg10286233
So if your wallet.dat is created in 2014 maybe this is the crypto you are looking for.


Title: Re: unknown wallet.dat format
Post by: nc50lc on December 29, 2019, 03:35:18 AM
MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"
Uhh, it starts with 'M' not 'W'  :-X
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?


Title: Re: unknown wallet.dat format
Post by: ewaspiro on December 29, 2019, 07:52:52 AM
Public key starts with W
The only one I could find was "Wagerr"... that uses addresses that start with a "W"

Just adding this below.

MIC3 coin address also start with "W" this is a sample of their address "MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY"

Their explorer here: https://mic3.magicdevs.pro/address/MmJ14UcTvYtQdsURSBDQy94LzK1EXvz9CY

Bitcurrency also have "W" addresses before the first address before they switch to "B" address.

Check this post https://bitcointalk.org/index.php?topic=867474.msg10286233#msg10286233
So if your wallet.dat is created in 2014 maybe this is the crypto you are looking for.

Thanks for the info guys, can I ask where did you find this info?


Title: Re: unknown wallet.dat format
Post by: rhomelmabini on December 29, 2019, 02:30:22 PM
Uhh, it starts with 'M' not 'W'  :-X
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Yeah, It really starts with "M". I presume that is the case as he give that example here.

Thanks for the info guys, can I ask where did you find this info?
Try clicking those links he gave and that will give you a hint. Google provide much info IMHO.


Title: Re: unknown wallet.dat format
Post by: BitMaxz on December 29, 2019, 10:39:00 PM
Uhh, it starts with 'M' not 'W'  :-X
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Ow sorry didn't notice the mic3 but I just search them in google that they are talking about switching the addresses from W address to other addresses.

Just like the Bitcurrency above as you can see they switch from W addresses to B addresses. So I think mic3 also switch from W address to M address.


Thanks for the info guys, can I ask where did you find this info?

I search them in Google using this term below.

Code:
"w address" site:bitcointalk.org

Including double quote and site:bitcointalk.org
Try it and you will find some post that includes with w address. then try to play the search engine and put your keyword inside the double quote.


Title: Re: unknown wallet.dat format
Post by: ewaspiro on January 01, 2020, 11:26:11 PM
Uhh, it starts with 'M' not 'W'  :-X
Did it started with "W" addresses then changed to 'M' just like Bitcurrency?
Ow sorry didn't notice the mic3 but I just search them in google that they are talking about switching the addresses from W address to other addresses.

Just like the Bitcurrency above as you can see they switch from W addresses to B addresses. So I think mic3 also switch from W address to M address.


Thanks for the info guys, can I ask where did you find this info?

I search them in Google using this term below.

Code:
"w address" site:bitcointalk.org

Including double quote and site:bitcointalk.org
Try it and you will find some post that includes with w address. then try to play the search engine and put your keyword inside the double quote.

Unfortunately none of the above works with my wallet



Title: Re: unknown wallet.dat format
Post by: nc50lc on January 02, 2020, 04:20:46 AM
Unfortunately none of the above works with my wallet
How about my suggestion above, have you tried to check for the TXID of those transactions and paste them in multi-currency block explorer?
And now that you have the list of addresses from the dump file, you can paste one of the addresses instead of TXID and that site might detect which coin/wallet it belongs.


Title: Re: unknown wallet.dat format
Post by: BitMaxz on January 02, 2020, 08:36:34 PM
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++

https://cnet4.cbsistatic.com/img/A-pscvmvT5gBa9J23zu-AJATLII=/1200x675/2012/06/07/398c4577-f0eb-11e2-8c7c-d4ae52e62bcc/Encrypted_text.png


Title: Re: unknown wallet.dat format
Post by: achow101 on January 03, 2020, 06:19:16 AM
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++

https://cnet4.cbsistatic.com/img/A-pscvmvT5gBa9J23zu-AJATLII=/1200x675/2012/06/07/398c4577-f0eb-11e2-8c7c-d4ae52e62bcc/Encrypted_text.png
wallet.dat files are not text files. You will not get a ton of readable text regardless of encryption. Furthermore, you most definitely will not see an xprv, Bitcoin Core does not store or use xprvs.

wallet.dat files are Berkeley DB files. You will need to have a tool specifically designed to read BDB files to really get meaningful information from them.


Title: Re: unknown wallet.dat format
Post by: ewaspiro on January 03, 2020, 10:24:53 AM
may it cost to open it through a text editor?

Why not try it.

If it is not encrypted with password you can see your address including xprv or the private key from the wallet.dat file but if it's encrypted you can see some text with boxes or random characters it will look like this below if you open it with notepad++

https://cnet4.cbsistatic.com/img/A-pscvmvT5gBa9J23zu-AJATLII=/1200x675/2012/06/07/398c4577-f0eb-11e2-8c7c-d4ae52e62bcc/Encrypted_text.png
wallet.dat files are not text files. You will not get a ton of readable text regardless of encryption. Furthermore, you most definitely will not see an xprv, Bitcoin Core does not store or use xprvs.

wallet.dat files are Berkeley DB files. You will need to have a tool specifically designed to read BDB files to really get meaningful information from them.

Yes I know, I tried dumpwallet.py and pywallet.py. This is not about reading the file but rather recognize the coin inside the wallet which I have disclosed earlier.


Title: Re: unknown wallet.dat format
Post by: achow101 on January 03, 2020, 04:26:48 PM
Yes I know, I tried dumpwallet.py and pywallet.py. This is not about reading the file but rather recognize the coin inside the wallet which I have disclosed earlier.
Download and install Berkeley DB 4.8.3 from https://www.oracle.com/database/technologies/related/berkeleydb-release-history.html

Open up a command prompt in the directory containing your wallet.dat file and do
Code:
db_dump wallet.dat
You will want to copy (or redirect) that output into a text file/editor.

Search for the string 1262657374626c6f636b. Look at the next like, it should be fairly long. Starting at the 10th character, copy the next 64 characters. This is a block hash represented in hex. You will need to byte swap it because it is stored in internal byte order. This means that every two characters at the beginning are swapped with their symmetric two characters from the end. You can then search for that block hash in various block explorers until you find one for the coin that it belongs to.

For example, in my wallet, I have:
Code:
 1262657374626c6f636b5f6e6f6d65726b6c65
 bcbe02001f398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000aa01a3461474942498219b371a297489c8e98e0726ca2d00000000000000000009a41bd091b58a66c3086ee87dfffac82f56d8a9cc1520000000000000000000d99c9828fec374230d19c9ce041d18bb0abbd902a1821f00000000000000000036a5f285a97de07dd3a36e8002d284a918c2ac5095ee0000000000000000000010dcd433003dd70a97169db7a03d784cc4c1f9204aa71c00000000000000000047d5c32538d7240af5bc1fcd162c656f4cc0a41b28820800000000000000000056ecc938d227a0d85af190a9b34dac6a5d8fc374adcf0c0000000000000000002690eed687e53530066986945ae7df3d1694be411f320a000000000000000000af828b14fa61f57401754aa5625635c27c96bc93b8261800000000000000000088f53e4684d64ec75e2ace5e4e138effbf838a2d1a4e1200000000000000000041317742072dc3779ed50d11f8f0f81974db61f9f89503000000000000000000deeace08a82d82c12787bdd986b38673bcd37328b79813000000000000000000f75ec406dce3b6933bbb5dbfca0681befe63432b49452a00000000000000000024692509bdb166ae9edf0369763ffef5ed33764d9c0c220000000000000000007f33440c4c65647b2c79a9dcc05db931e81b14d929950800000000000000000020d876aaddb18d93414a0b41c651c0955230acd3cd9203000000000000000000460d02a06510794a5af955984530706dbdce386b6a8711000000000000000000b9944fae9baf038329f1d618d18de8589b1c724184842a000000000000000000aa33e53a7a77f9cb39aab9b9bf229e872633187ede4504000000000000000000f696c443c06a2552f8193b7dc93a3b62f48e6294bb1b1b00000000000000000014f1054a9fc8cdf8893f7634fc0a0afa0f8554cba0b62a000000000000000000f01cc261faa46dae158f5f4372af5e02d5a17c6994772b000000000000000000ae51a37bd455a1d6790d43e133c995988aabb163176a04000000000000000000867af3560bf4aab1cea599889b5830f702d2b9650a5f03000000000000000000d3b00067c837dcbdec5dd1fb5cda597fa03f8c90f12c29000000000000000000ca75b9384b21187013044c74585573b4e46fb9a71207480000000000000000004e504c2b55677b208da3867b4f628db2da6eace0ec834e040000000000000000d85b9f567ff6bbed506960c8b76498bae153c086d56d2e5f0000000000000000726e26f93314df0ed59c2af2c9f891f1f435f3dab0f8e534e336543f000000006fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000

Skipping the first 10 characters gives me:
Code:
398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000aa01a3461474942498219b371a297489c8e98e0726ca2d00000000000000000009a41bd091b58a66c3086ee87dfffac82f56d8a9cc1520000000000000000000d99c9828fec374230d19c9ce041d18bb0abbd902a1821f00000000000000000036a5f285a97de07dd3a36e8002d284a918c2ac5095ee0000000000000000000010dcd433003dd70a97169db7a03d784cc4c1f9204aa71c00000000000000000047d5c32538d7240af5bc1fcd162c656f4cc0a41b28820800000000000000000056ecc938d227a0d85af190a9b34dac6a5d8fc374adcf0c0000000000000000002690eed687e53530066986945ae7df3d1694be411f320a000000000000000000af828b14fa61f57401754aa5625635c27c96bc93b8261800000000000000000088f53e4684d64ec75e2ace5e4e138effbf838a2d1a4e1200000000000000000041317742072dc3779ed50d11f8f0f81974db61f9f89503000000000000000000deeace08a82d82c12787bdd986b38673bcd37328b79813000000000000000000f75ec406dce3b6933bbb5dbfca0681befe63432b49452a00000000000000000024692509bdb166ae9edf0369763ffef5ed33764d9c0c220000000000000000007f33440c4c65647b2c79a9dcc05db931e81b14d929950800000000000000000020d876aaddb18d93414a0b41c651c0955230acd3cd9203000000000000000000460d02a06510794a5af955984530706dbdce386b6a8711000000000000000000b9944fae9baf038329f1d618d18de8589b1c724184842a000000000000000000aa33e53a7a77f9cb39aab9b9bf229e872633187ede4504000000000000000000f696c443c06a2552f8193b7dc93a3b62f48e6294bb1b1b00000000000000000014f1054a9fc8cdf8893f7634fc0a0afa0f8554cba0b62a000000000000000000f01cc261faa46dae158f5f4372af5e02d5a17c6994772b000000000000000000ae51a37bd455a1d6790d43e133c995988aabb163176a04000000000000000000867af3560bf4aab1cea599889b5830f702d2b9650a5f03000000000000000000d3b00067c837dcbdec5dd1fb5cda597fa03f8c90f12c29000000000000000000ca75b9384b21187013044c74585573b4e46fb9a71207480000000000000000004e504c2b55677b208da3867b4f628db2da6eace0ec834e040000000000000000d85b9f567ff6bbed506960c8b76498bae153c086d56d2e5f0000000000000000726e26f93314df0ed59c2af2c9f891f1f435f3dab0f8e534e336543f000000006fe28c0ab6f1b372c1a6a246ae63f74f931e8365e15a089c68d6190000000000

The 64 characters at the beginning are:
Code:
398d305048481ee6b096d2a96ab996ad380c6865e5521f000000000000000000

Byte swapping that results in the hash:
Code:
0000000000000000001f52e565680c38ad96b96aa9d296b0e61e484850308d39

When looking up that hash in a block explorer, you will see that it is block 564035 in the Bitcoin blockchain.


If you don't find that particular string, try searching for 0962657374626c6f636b instead.


Title: Re: unknown wallet.dat format
Post by: butt_coin on January 06, 2020, 12:30:42 AM
Hey there. I recently made an open source tool that will, among other things, automatically figure out the version prefix from metadata inside the wallet and dump out the contents. You can find it here: https://github.com/jimtje/walletlib

Although if you already know that your public key starts with a W, the version prefix byte is going to be either 72, 73, or 74. Just looking on Github, these may fit the bill, although not sure if they date back to 2014. Basically, the coins on these search results (there are quite a few):

https://github.com/search?o=asc&q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+73%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&s=indexed&type=Code

https://github.com/search?q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+72%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&type=Code

https://github.com/search?q=%22base58Prefixes%5BPUBKEY_ADDRESS%5D+%3D+std%3A%3Avector%3Cunsigned+char%3E%281%2C+74%29%3B%3B%22+filename%3Achainparams.cpp+fork%3Atrue&type=Code